Privacy policy

PigeonDM (“the application”, “we”) is an automation tool that, with the authorization of the owner of a professional Instagram account, detects comments containing a keyword and automatically sends a private reply (direct message) through Meta’s official API.

Data controller: Antonin Langlade. Contact: info@pigeondm.com.

When a comment is posted on a post of a connected account, we receive and process the following information through the Meta API:

• the content of the comment;
• the username and Instagram id of its author;
• the id of the post concerned;
• the time it was received.

Instagram also notifies us of the direct messages a connected account receives, including replies to its stories, whether or not its owner uses DM replies, a Pro feature: Instagram does not let an app choose account by account. For an account that has not turned the feature on, we discard these notifications on arrival: we do not look for words in them and we do not store them. For an account that has, we read each message only to look for the owner’s words, and keep only those that contain one: the sender’s Instagram id and username, the text, whether it answered a story, and the reply we sent. The others are never stored.

We collect no passwords, no payment data and no private content beyond what is strictly necessary for the operation described here.

This data is used only to:

• detect the keyword configured by the account owner;
• send the private reply (ref / link) to the author of the comment;
• when DM replies are on, send the reply set by the account owner to someone who sent one of its words by direct message;
• keep a technical log of what was processed, for reliability and debugging.

Processing relies on the account owner’s legitimate interest in replying to their community, and on the implicit consent of the person who comments publicly with the explicit aim of getting the reply announced by the post.

Supabase (PostgreSQL) holds the data; Vercel runs the application. The server reaches that database with a confidential service key that never leaves it, so no sensitive value ever reaches the browser. All traffic goes over HTTPS. Instagram’s notifications first pass through a filter at Cloudflare, which reads each one only to decide whether to pass it on. Our server then refuses any notification that arrives without a valid X-Hub-Signature-256 signature, before processing it.

We never sell or rent it. It reaches only the providers the service cannot run without, each acting on our instructions and nothing more:

• Meta / Instagram sends us the comments and delivers the messages.
• Cloudflare receives Instagram’s notifications first and passes them on to us. It drops the ones we have no use for: message notifications we do not act on, an account’s own comments on its posts, messages to an account that has DM replies off, and comments on an account that has no post turned on. It keeps none of their content: for three days, only a line per notification saying whether it was passed on and why, with no identifier. To know which accounts have DM replies on, and which have no post turned on, it holds two lists of fingerprints of their Instagram ids made with a secret key, so neither list on its own reveals an id. It also counts its decisions per hour, by reason and by that same fingerprint of the account concerned, never of the person who commented or wrote, and Cloudflare keeps those counts for three months so we can see which account a surge comes from.
• Supabase (PostgreSQL) stores the accounts, the per-post configuration and the activity log.
• Vercel runs the application and its scheduled jobs, and counts page views without cookies.
• Inngest queues each incoming comment until it has been handled, so a comment is never lost when a send fails. The queued event carries the comment text and its author’s handle, or, for DM replies, the message text and its sender’s Instagram id.
• PostHog (EU) records product usage. It receives the connected account’s Instagram user id and handle, so we can tell whether a connection succeeded. It never receives a message body, a commenter’s handle, or an access token.
• ntfy sends us a phone notification when an account connects, changes plan or removes the app, with that account’s Instagram handle. When an account deletes its data, the notification carries no handle.

PostHog also measures visits to this site: the pages viewed, the clicks, and a recording of each visit. The page’s text, anything typed into a field and all images are masked in your browser before anything is sent, and PostHog does not keep IP addresses. Nothing is stored on your device, so a later visit cannot be linked to this one. When you are signed in, these events are linked to your account. You can turn this measurement off for this browser, which then keeps that one choice:

The activity log is deleted after 60 days, by a scheduled job in the database rather than on request. Five things outlive it on purpose. Your per-post configuration, and the words and messages of your DM replies, stay until you change or delete them, because they are what makes the service work. The record that a given person already received a DM for a given post is permanent, because it is the only thing that guarantees we never message anyone twice; it holds an Instagram user id and a post id, no message and no comment text.

And we keep daily totals of what the service did, one row per day: how many comments arrived, how many messages went out, how many failed. Those rows carry no account, no Instagram id and no text, so they describe the service and not you. That is what lets us answer “was June better than May” after the log itself is gone.

Finally, for your own account, we keep a daily count of your activity: how many comments your posts received, how many DMs went out, how many failed, one row per day. These carry no comment text and no third-party identity, so they describe your account’s volume rather than the people who commented. We keep them past the log so you can see your own trends beyond 60 days, and they are erased when you delete your account.

The direct messages kept by DM replies are deleted after 60 days, like the log. The record that a person already got the reply for a given word is permanent until the account is deleted, for the same reason as above: it is what stops us from sending it twice. It holds an Instagram user id and the date, no message text.

A free account with no activity for 180 days is closed. No activity means no sign-in with Instagram, no comment received on an active post, no message sent and no click on its links during that time. Closing works like removing the app from Instagram (section 9): the access token is destroyed at once, and the rest is kept for 30 days, then erased. Reconnecting within that window cancels the erasure. Paid accounts are never closed for inactivity, and for a former subscriber the 180 days start when the paid period or free month ends.

Under the GDPR, you have a right of access, rectification, erasure, restriction and objection. To exercise it, write to us at info@pigeondm.com.

Three ways, all of them immediate and none of them requiring us to do anything by hand:

• From the app. Settings → Delete my account. This erases the access token, your posts and keywords, and the whole activity log, at once and irreversibly, then hands you a confirmation code to keep.
• From Instagram, by removing the app. Settings → Apps and websites → PigeonDM → Remove. Instagram notifies us, and the access token is destroyed straight away, so nothing can be read or sent any more. Your configuration is kept for 30 days and then erased automatically. Reconnecting within that window cancels the deletion and keeps your setup.
• By asking Instagram to delete your data. Instagram sends us a signed deletion request; we erase everything immediately and return a link showing the status of your request, with a confirmation code.

We keep a receipt of each request, so we can show it was honoured. That receipt contains no Instagram username and no Instagram user id, only a one-way fingerprint that cannot be reversed back to an account.

Separately from any request, comment data is deleted automatically after 60 days. If you would rather write to a human: info@pigeondm.com.

PigeonDM works through Meta’s official Instagram API, under the Meta Platform Terms and the Developer Policies. We use what that API returns for the purposes described above, and for nothing else. No resale, no advertising profiles, no training of models on your audience.

This policy may be updated; the date of the last update appears at the top of the page.

Antonin Langlade · info@pigeondm.com